The 49 Amazon Bedrock security checks Black Cat runs
Black Cat SSPM evaluates 49 security policies against your Amazon Bedrock configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Amazon Bedrock — what access Black Cat needs, and why.
Access control & privilege
11 checks · highest severity: critical
Data sharing & exposure
12 checks · highest severity: high
Logging & audit
3 checks · highest severity: medium
Configuration hardening
12 checks · highest severity: high
AI governance
7 checks · highest severity: critical
Lifecycle & offboarding
4 checks · highest severity: critical
Access control & privilege (11)
- Bedrock Agent Overprivileged Execution Role severity: critical
- Bedrock Agent Cross-Account Role severity: high
- Bedrock Agent No Guardrail severity: high
- Bedrock Agent Excessive Action Groups severity: medium
- Bedrock Knowledge Base Overprivileged Role severity: high
- Bedrock Flow Overprivileged Execution Role severity: high
- Bedrock AgentCore Runtime Overprivileged Execution Role severity: critical
- Bedrock AgentCore Runtime Cross-Account Role severity: high
- Bedrock AgentCore Harness Overprivileged Execution Role severity: critical
Data sharing & exposure (12)
- Bedrock Agent Multiple Knowledge Bases severity: medium
- Bedrock Agent No Customer-Managed Encryption severity: medium
- Bedrock Agent Session Memory Enabled severity: low
- Bedrock Agent Long Session TTL severity: medium
- Bedrock Guardrail Without Customer-Managed Key severity: medium
- Bedrock Guardrail PII Detect-Only severity: medium
- Bedrock Knowledge Base On Third-Party Vector Store severity: high
- Bedrock Flow Without Customer-Managed Key severity: low
- Bedrock Agent Relays History To Collaborators severity: medium
- Bedrock AgentCore Gateway Without Customer-Managed Key severity: medium
- Bedrock AgentCore Memory Without Customer-Managed Key severity: medium
- Bedrock AgentCore Memory Long Retention severity: low
Logging & audit (3)
- Bedrock Model Invocation Logging Disabled severity: medium
- Bedrock Model Invocation Logging Partial severity: low
- Bedrock AgentCore Browser Recording Disabled severity: low
Configuration hardening (12)
- Bedrock Guardrail Weak Content Filters severity: medium
- Bedrock No Guardrails Configured severity: high
- Bedrock Flow References Draft Prompt severity: medium
- Bedrock Orphaned Knowledge Base severity: low
- Bedrock Guardrail Filters Disabled severity: high
- Bedrock Guardrail Without Contextual Grounding severity: low
- Bedrock AgentCore Gateway Without Policy Engine severity: medium
- Bedrock AgentCore Gateway Without WAF severity: low
- Bedrock AgentCore Gateway Without Rate Limits severity: low
- Bedrock AgentCore Runtime Public Network severity: low
- Bedrock AgentCore Policy Engine Log-Only Policies severity: medium
- Bedrock AgentCore Sandbox Public Network severity: medium
AI governance (7)
- Bedrock Action Group Code Interpreter severity: high
- Bedrock Action Group Computer Use / Bash severity: critical
- Bedrock Agent Custom Orchestration severity: low
- Bedrock Agent Supervisor Mode severity: medium
- Bedrock Agent High Risk Unblocked severity: high
- Bedrock Agent Prompt Override Lambda severity: medium
- Bedrock AgentCore Agent High Risk Unblocked severity: high
Lifecycle & offboarding (4)
- Bedrock Agent Failed Status severity: critical
- Bedrock Agent Not Prepared (7+ days) severity: medium
- Bedrock Agent Stale severity: low
- Bedrock Agent Orphaned Owner severity: high